Docker Hub 数据库被入侵
yuhr123 · yuhr123 · 2019-04-27 10:43:23 +08:00 via iPhone · 6170 次点击这是一个创建于 2030 天前的主题，其中的信息可能已经有所发展或是发生改变。
刚刚收到 Docker 支持团队的邮件，告知由于数据库被入侵有 190000 用户账号和密码（已哈希）受影响，财务相关信息未受影响。GitHub 和 bitbucket 的歌曲 token 也被泄漏了，建议尽快修改相关密码。
On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data. Upon discovery, we acted quickly to intervene and secure the site.
During a brief period of unauthorized access to a Docker Hub database, sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of these users, as well as Github and Bitbucket tokens for Docker autobuilds.
On Thursday, April 25th, 2019, we discovered unauthorized access to a single Hub database storing a subset of non-financial user data. Upon discovery, we acted quickly to intervene and secure the site.
During a brief period of unauthorized access to a Docker Hub database, sensitive data from approximately 190,000 accounts may have been exposed (less than 5% of Hub users). Data includes usernames and hashed passwords for a small percentage of these users, as well as Github and Bitbucket tokens for Docker autobuilds.
 |
1
d5 2019-04-27 12:03:49 +08:00 via iPhone
这就很难受了
|
 |
2
fanyingmao 2019-04-27 12:20:18 +08:00 via Android
他的哈希希望别是简单的 md5，不然大部分简单密码会被查出。
|
 |
3
SenLief 2019-04-27 12:48:20 +08:00 via Android
主要是尼玛泄露都用的同一套密码，擦还得全改嘛？
|
 |
4
zhang330700 2019-04-27 13:22:23 +08:00
起码还主动公布了...
|
 |
5
lusi1990 2019-04-27 13:23:16 +08:00 via Android
回去看看 我有账号不，要不得全改
|
 |
6
maxlino 2019-04-27 13:42:48 +08:00 via iPhone
还好是 1Password 生成随机密码🌚
|
 |
7
longnight 2019-04-27 14:08:10 +08:00 via Android
应该用了自己的 salt 吧, 所以担心的话只要改 docker 的密码就好
|
 |
8
vencentge 2019-04-27 14:17:41 +08:00 via iPhone
问题严重的在于 github 上的 token 被拿了，这个就延伸了危害面
|
 |
9
whatsmyip 2019-04-27 18:26:53 +08:00
赶紧删了授权
|
 |
10
watzds 2019-04-27 20:00:19 +08:00
前几天刚注册就这样了。。
|
 |
11
whileFalse 2019-04-27 21:18:50 +08:00
我的习惯是不在源代码和构建系统中硬编码任何敏感信息；敏感信息都是在运行时注入。
|
Select Language